X41 D-Sec GmbH Security Advisory: X41-2017-010

Command Execution in shadowsocks-libev


Summary and Impact

ShadowSocks-libev offers local command execution per configuration file or/and additionally, code execution per UDP request on

The configuration file on the file system or the JSON configuration received via UDP request is parsed and the arguments are passed to the “add_server” function.
The function calls “construct_command_line(manager, server);” which returns a string from the parsed configuration. The string gets executed at line 486 “if (system(cmd) == -1) {“, so if a configuration parameter contains “||evil command&&” within the “method” parameter, the evil command will get executed.

The ss-manager uses UDP port 8830 to get control commands on By default no authentication is required, although a password can be set with the ‘-k’ parameter.

Product Description

Shadowsocks-libev is a lightweight secured SOCKS5 proxy for embedded devices and low-end boxes. The ss-manager is meant to control shadowsocks servers for multiple users, it spawns new servers if needed.

It is a port of shadowsocks created by @clowwindy, and maintained by @madeye and @linusyang.

Proof of Concept

As passed configuration requests are getting executed, the following command will create file “evil” in /tmp/ on the server:

nc -u 8839
    add: {"server_port":8003, "password":"test", "method":"||touch /tmp/evil||"}

The code is executed through shadowsocks-libev/src/manager.c. If the configuration file on the file system is manipulated, the code would get executed as soon as a shadowsocks instance is started from ss-manage, as long as the malicious part of the configuration has not been overwritten.


There is no workaround available, do not use ss-manage until a patch is released.

About X41 D-Sec GmbH

X41 D-Sec is a provider of application security services. We focus on application code reviews, design review and security testing. X41 D-Sec GmbH was founded in 2015 by Markus Vervier. We support customers in various industries such as finance, software development and public institutions.